We may share your personal data with a third party where this is required by law or where we have another legitimate interest (Art. 6 (1) (f) GDPR) in doing so.

We may also need to share your personal data with:

• other entities within our group, namely Turtle Beach Germany GmbH as our representative, as part of our regular reporting activities, in the context of a business reorganisation or group restructuring exercise, for assistance in relation to marketing and business development or in connection with the operation of group-wide functions and services;
  
• professional advisers, including lawyers, bankers, auditors and insurers to the extent such information is relevant to their performance of their services;
  
• regulators and government bodies;
  
• IT service providers (such as cloud services providers, IT consultants and software-as-a-service providers); and
  
• any of our service providers where such information is relevant to their performance of such services.
  

Examples of who may process your personal data in different scenarios are set out below.

If you place an order through our website

Our website is currently operated by us and uses the Shopify online e-commerce platform. When you place an order, Shopify will process your payment details on our behalf. We neither store credit card details nor do we share financial details with any third parties. Please note that for purposes of processing your transaction for goods and services provided by us, we may share your name, physical and IP address with Shopify. You find Shopify’s Privacy Policy at https://www.shopify.com/legal/privacy. In addition, please note Shopify’s White Paper on its international data transfers (https://help.shopify.com/pdf/cross-border-whitepaper.pdf). As stated in this White Paper, Shopify’s global platform, Shopify International Ltd. (an Irish entity) may transfer EEA personal data to Shopify Inc. (a Canadian entity) that may then share such data sets with sub-processors in Canada and other countries, such as the United States. For these transfers Shopify does not rely on EU Standard Contractual Clauses. Instead, Shopify transfers the relevant data sets pursuant to the requirements of PIPEDA (the Canadian privacy law), which the European Commission has determined provides adequate data protection under the GDPR, and subject to specific contractual agreements. Please consult the mentioned White Paper that also includes FAQ and a diagram illustrating the flow of data of European residents, and how Shopify ensures protection for each step. Please also note that to the extent that you open your own account with Shopify, Shopify may act as its own independent data controller for your personal data and may use such data for other or additional purposes based on their Privacy Policy.

For its European customers Turtle Beach cooperates with Klarna Bank AB with its principal place of business at Sveavägen 46, 111 34 Stockholm, Sweden (“Klarna”) as a provider of solutions for checkouts, such as Klarna’s Shopping Solution. For instance, Klarna processes your personal data when you use one of Klarna's payment methods, log in to a merchant website connected with Klarna, or choose to pay by debit or credit card during the payment process in Klarna's checkout with a merchant. In all these cases Klarna acts as a separate and independent data controller and not as our data processor for the personal data it receives via the platform for these purposes. Klarna may also use these personal data in order to send newsletters, to conduct product surveys, to advertise similar products or services of Klarna and for event invitations, provided that Klarna has the right to do so pursuant to applicable laws. The services provided by Klarna are subject to separate Klarna privacy policies, prompted before the first use of such service that also list your rights under applicable laws. You find a list of the relevant Klarna privacy policies per country here: https://www.klarna.com/international/privacy-policy/. Also please note that Klarna Bank may set cookies for their site as you check out on a Klarna webpage.

When you place an order, we may share your name, physical and email address and order details (date, amount, product) with Signifyd for fraud prevention services. Signifyd is located at 99 Almaden Blvd., 4th floor, San Jose, CA 95113, USA (www.signifyd.com) and is responsible for performing its service as set forth in an agreement with us, as an independent controller and not as a processor, namely for the purposes of fraud identification, prevention, dispute and monitoring, and to analyze data for the purpose of building, maintaining and improving Signifyd’s predictive models and fraud-related services through Signifyd’s own AI model for the same purposes. We have Module 1 EU Standard Contractual Clauses with Signifyd (controller-to-controller) with UK and Swiss addenda with Signifyd in place. Signifyd has a separate legitimate interest to process these sets data as Signifyd is independently endorsing an order, and it is in Signifyd’s sole discretion to approve a transaction/provide a financial guarantee to us for the order amount. Signifyd has received and actively maintains SOC 2, Type 2 and PCI compliance certifications from an independent third-party auditor. Signify’s privacy policy is available here https://www.signifyd.com/privacy/.

The legal basis for this sharing of the mentioned personal data with Signifyd as an independent controller is that it is in our legitimate interest (Art. 6 (1) (f) GDPR) to discover fraud and to protect ourselves against fraudulent orders. The GDPR recognizes fraud identification, prevention, dispute and monitoring in Recitals 47 and 71 as legitimate interests that provide a legal basis for a controller to process personal data.

If you sign up to receive e-mail marketing from us (controller only Voyetra Turtle Beach, Inc.)

When you sign up for our e-mail communications, your personal data is processed by Klaviyo, an email service provider, with its corporate address at 125 Summer St, 6th floor, Boston MA 02110, United States. ( https://www.klaviyo.com/and its privacy policy at https://www.klaviyo.com/legal/privacy-policy). Klaviyo stores and administers your consent and acts as data processor on our behalf and processes your personal data on our instructions. We have enabled website tracking, so that Klaviyo identifies individuals that click through a Klaviyo email and browse our website. Klaviyo will not track anonymous browsers. If you have questions how your consent is processed, please contact at privacy@klaviyo.com. Klaviyo has implemented EU Standard Contractual Clauses and other appropriate measures to comply with the EU data transfer rules (Art. 46 GDPR). The European Commission has certified that the EU Standard Contractual Clauses, in addition with other measures to safeguard the data, provide an adequate level of protection in respect of personal data.

We may also share your personal data with third parties in the context of the possible sale or restructuring of our business. We may also need to share your personal data with a regulator or to otherwise comply with applicable law or judicial process or if we reasonably believe that disclosure is necessary to protection our rights and/or to comply with judicial or regulatory proceedings, a court order or other legal inquiries.

We are based in the USA (Voyetra Turtle Beach, Inc.) and in the UK (Turtle Beach Europe Ltd.). Your personal data may be held by us or our service providers in the USA or in the UK. Sometimes we may also transfer your personal data to other jurisdictions outside the European Economic Area (‘EEA’). For example, we may use cloud service providers who store personal data on servers in jurisdictions outside the EEA.

The European Commission has not finally determined that the laws of the USA and of the UK generally provide an adequate level of protection in respect of personal data. Other non-EEA jurisdictions may similarly not provide the same level of protection in respect of personal data as in the EEA. Where required by the GDPR, we will (or will require a processor to) put in place appropriate safeguards such as the Standard Contractual Clauses approved by the European Commission. We also use EU Standard Contractual Clauses to protect your personal data that Turtle Beach Germany may share with Turtle Beach Europe after BREXIT.

As indicated above, we rely on your consent as our legal basis to send you e-mail marketing. You have the right to withdraw your consent to this processing at any time.

To withdraw your consent where you have previously consented to direct marketing, you can unsubscribe from direct marketing communications from us by:

• clicking the ‘unsubscribe’ link in any e-mail communication that we send you; or
• contacting us using the contact details listed below.

Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose to which you originally consented unless we now have an alternative legal basis for doing so.

We will retain your personal data and other information for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting or reporting requirements and our legitimate interests in maintaining such personal information in our records. For this we will consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

For example, we may retain the personal data we use for sending direct marketing email to you for so long as you subscribe to our e-mail mailing list. You can unsubscribe from direct marketing communications from us at any time as explained in Section 5 above. We may also remove such personal data in circumstances where you have not unsubscribed, such as where our e-mails to you are failing to deliver to your e-mail address or if you consistently do not open the e-mails that we send.

Once we no longer require your personal data for the purposes for which it was collected, we will securely destroy your personal data or anonymize them in accordance with applicable laws and regulations. Alternatively, the information may be anonymised so that it can no longer be associated with you, in which case it is no longer personal data.

To the extent your personal data are processed, you are a data subject within the meaning of the GDPR and you have the following rights:

a) Right of access

You have the right to obtain a confirmation from us whether we process personal data concerning you , and, where that is the case, access to the personal data and the following information:

1. the purposes of the processing;
2. the categories of personal data concerned;
3. the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
4. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
5. the existence of the right to request from us rectification or erasure of personal data or restriction of processing of personal data or to object to such processing;
6. the right to lodge a complaint with a supervisory authority;
7. where the personal data are not collected from you, any available information as to their source;
8. the existence of automated decision-making, including profiling, referred to in Art. 22 para. 1 and 4 GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

You have the right to request information whether the personal data concerning you are transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate guarantees pursuant to Art. 46 GDPR for such data transfer.

b) Right of rectification

It is important that the personal data we hold about you is accurate and current. Please let us know if your personal data which we process change during your relationship with us. 

c) Right to restriction of processing

You shall have the right to obtain from us restriction of processing where one of the following applies: 

1. the accuracy of the personal data is contested by yourself, for a period enabling us to verify the accuracy of the personal data;
2. the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
3. we no longer need the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims;
4. You have objected to processing pursuant to Art. 21 para. 1 GDPR pending the verification whether the legitimate grounds override those of the data subject.

Where the processing has been restricted, such personal data shall, with the exception of storage, will only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of an EU Member State.

d) Right to erasure (‘right to be forgotten’)

You shall have the right to obtain from us the erasure of personal data concerning you. In this case, we have the obligation to erase your personal data without undue delay where one of the following grounds applies:

1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. you withdraw consent on which the processing is based according to Art. 6 para.1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, and where there is no other legal ground for the processing;
3. you object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para 2 GDPR;
4. the personal data have been unlawfully processed;
5. the personal data must be erased for compliance with a legal obligation in the European Union, or
6. the personal data have been collected in relation to the offer of information society services referred to in Article 8 para.1 GDPR.

The right to erasure shall not apply to the extent that processing is necessary:

1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation which requires processing by the European Union or for the performance of a task carried out in the public interest
3. for archiving, scientific or historical research purposes in the public interest or for statistical purposes in accordance with Art. 89 para. 1 GDPR, insofar as the right referred to in section a) is likely to make it impossible or seriously impede the attainment of the objectives of such processing, or
4. for the establishment, exercise or defense of legal claims.

e) Notification regarding rectification or erasure of personal data or restriction of processing

We will communicate any rectification or erasure of personal data or restriction of processing carried to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves a disproportionate effort. We will inform you about those recipients if you request it.

f) Right to data portability

You have the right to receive the personal data, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: 

1. the processing is based on consent pursuant to Art. 6 para 1 lit. a or Art. 6 para 1 lit. b or Art. 2 para 2 lit. a GDPR, or
2. the processing is carried out by automated means.

The right shall not adversely affect the rights and freedoms of others.

In exercising your right to data portability, you shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

The exercise of this right shall be without prejudice to the right of erasure. That right shall not apply to any processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

g) Right to object

You shall have the right to object, at any time to processing of your personal data under the GDPR. We will no longer process the personal data, unless there are legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.

h) Right to revoke the declaration of consent

You have the right to revoke your data protection declaration of consent at any time. Your revocation of your consent does not affect the legality of the processing that has taken place on the basis of your consent until your revocation.

i) Right of complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right of appeal to a supervisory authority, in particular in the European Member State where you reside, work or suspect an infringement if you believe that the processing of personal data concerning you is not in compliance with GDPR.